Files
wikideck/tests/testnet-ledger.test.ts
T
2026-10-29 11:45:51 -04:00

736 lines
42 KiB
TypeScript

import test from 'node:test';
import assert from 'node:assert/strict';
import { generateKeyPairSync, sign } from 'node:crypto';
import { mkdtemp, readFile, writeFile, rm, rename, mkdir, stat, truncate } from 'node:fs/promises';
import { tmpdir } from 'node:os';
import { join } from 'node:path';
import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';
import dns from 'node:dns/promises';
import { DatabaseSync } from 'node:sqlite';
import { setTimeout as delay } from 'node:timers/promises';
import { Ledger } from '../server/testnet/ledger.ts';
import { PeerNetwork } from '../server/testnet/peers.ts';
import { CHAIN_ID, GENESIS_HASH, GENESIS_TIME, MAX_TARGET, address, makeTemplate, miningBlob,
mintId, sha256, stateRoot, transferId, transition, validateBlock, workFor } from '../server/testnet/consensus.ts';
import { NETWORK, CONSENSUS, blockClaimMessage, nftTransferMessage, testnetOwnerOf, transactionCardIds,
nftTradeMessage, type MiningTemplate, type NftState, type NftStateLayer, type NftStateView,
type NftTrade, type NftTransfer, type TestnetBlock } from '../shared/testnet.ts';
import { deriveStats } from '../shared/enrichment.ts';
import type { PowEngine } from '../server/testnet/randomx.ts';
// Deliberately test-only: production has no fake PoW selector or fallback.
class FakePow implements PowEngine {
calls = 0;
async hash(key: string, blob: Uint8Array): Promise<string> {
this.calls++;
return sha256(Buffer.concat([Buffer.from(key, 'hex'), Buffer.from(blob)]));
}
close(): void {}
}
function identity() {
const keys = generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
const publicKey = keys.publicKey.export({ format: 'der', type: 'spki' }).toString('base64');
return { publicKey, owner: address(publicKey), sign: (message: string) =>
sign('sha256', Buffer.from(message), { key: keys.privateKey, dsaEncoding: 'ieee-p1363' }).toString('base64') };
}
const alice = identity(), bob = identity(), carol = identity();
type Identity = ReturnType<typeof identity>;
const pow = new FakePow();
async function mine(template: MiningTemplate, miner: Identity = alice): Promise<TestnetBlock> {
const header = structuredClone(template.header);
assert.ok(BigInt(`0x${header.target}`) <= BigInt(`0x${MAX_TARGET}`));
for (header.nonce = 0; header.nonce < 1_000_000; header.nonce++) {
const blob = miningBlob(header);
const powHash = await pow.hash(header.key, blob);
if (BigInt(`0x${powHash}`) > BigInt(`0x${header.target}`)) continue;
const hash = sha256(blob);
return { ...header, hash, tokenId: mintId(header), powHash,
signature: miner.sign(blockClaimMessage(hash)), transactions: structuredClone(template.transactions) };
}
throw new Error('Test nonce search exhausted');
}
type Branch = { blocks: TestnetBlock[]; state: NftStateView };
function branch(): Branch { return { blocks: [], state: {} }; }
function articleFor(_ancestors: TestnetBlock[]) {
const pageId = 50_000;
return { pageId, title: `Test article ${pageId}`, extract: `A deterministic test article snapshot for Wikipedia page ${pageId}.`,
image: 'https://upload.wikimedia.org/wikipedia/commons/test-image.jpg',
url: `https://en.wikipedia.org/?curid=${pageId}`, revisionId: 1, source: 'live' as const, category: 'Culture' };
}
function statsSnapshot() {
const pageBytes = 2048, languageCount = 3;
return { capturedAt: '2026-10-19T00:00:00.000Z', revisionId: 1, pageBytes, languageCount,
languagesTruncated: false, pageviews: { status: 'unavailable' as const, months: [], latestMonth: '2026-09',
total: null, dailyAverage: null, trendPercent: null }, stats: deriveStats(pageBytes, languageCount, null) };
}
async function extend(chain: Branch, miner: Identity = alice, transactions: NftTransfer[] = [],
spacing = 30): Promise<TestnetBlock> {
const now = GENESIS_TIME + (chain.blocks.length + 1) * spacing;
const block = await mine(makeTemplate(chain.blocks, chain.state, miner.owner, miner.publicKey,
transactions, articleFor(chain.blocks), statsSnapshot(), now), miner);
chain.state = transition(chain.state, block, transactions);
chain.blocks.push(block);
return block;
}
function transfer(cardHash: string, from: Identity = alice, to: Identity = bob, sequence = 0): NftTransfer {
const tx = { network: NETWORK, chainId: CHAIN_ID, cardHash, from: from.owner, to: to.owner,
sequence, publicKey: from.publicKey };
return { ...tx, signature: from.sign(nftTransferMessage(tx)) };
}
function trade(offered: TestnetBlock[], requested: TestnetBlock[], proposer: Identity = alice,
counterparty: Identity = bob): NftTrade {
const terms = { network: NETWORK, chainId: CHAIN_ID, proposer: proposer.owner, counterparty: counterparty.owner,
offered: offered.map(block => ({ cardHash: block.tokenId, sequence: 0 })),
requested: requested.map(block => ({ cardHash: block.tokenId, sequence: 0 })) };
const message = nftTradeMessage(terms);
return { type: 'trade', ...terms, proposerPublicKey: proposer.publicKey, proposerSignature: proposer.sign(message),
counterpartyPublicKey: counterparty.publicKey, counterpartySignature: counterparty.sign(message) };
}
async function fixture(t: { after: (fn: () => Promise<void>) => void }) {
const dir = await mkdtemp(join(tmpdir(), 'wikideck-testnet-'));
const engine = new FakePow();
const ledger = await Ledger.open(dir, engine);
t.after(async () => { ledger.close(); engine.close(); await rm(dir, { recursive: true, force: true }); });
return { dir, ledger, engine, file: join(dir, 'testnet', 'ledger.sqlite') };
}
test('testnet genesis is empty, manifest-bound, isolated and defensively copied', async t => {
const { dir, ledger, file } = await fixture(t);
const initial = ledger.snapshot();
assert.equal(initial.network, NETWORK);
assert.equal(initial.chainId, CHAIN_ID);
assert.equal(initial.genesis, GENESIS_HASH);
assert.equal(initial.tip, GENESIS_HASH);
assert.equal(initial.cumulativeWork, '0');
assert.equal(initial.algorithm, 'RandomX');
assert.equal(initial.maturity, 2);
assert.equal(initial.peers, 0);
assert.deepEqual(initial.blocks, []);
assert.deepEqual(initial.transfers, []);
assert.deepEqual(initial.pendingTransfers, []);
assert.equal(stateRoot({}), sha256(`${NETWORK}:empty`));
await assert.rejects(readFile(join(dir, 'chain.json')), /ENOENT/);
assert.equal((await stat(file)).isFile(), true);
const database = new DatabaseSync(file);
assert.equal((database.prepare('SELECT COUNT(*) AS count FROM blocks').get() as { count: number }).count, 0);
database.close();
const candidate = await mine(ledger.template(alice.owner, alice.publicKey, articleFor([]), statsSnapshot()));
assert.deepEqual(await ledger.submit(candidate), { accepted: true, reorg: false });
const persisted = new DatabaseSync(file);
assert.equal((persisted.prepare('SELECT COUNT(*) AS count FROM blocks').get() as { count: number }).count, 1);
persisted.close();
candidate.article.title = 'caller mutation';
const copy = ledger.block(candidate.hash)!;
copy.article.title = 'getter mutation';
assert.notEqual(ledger.block(candidate.hash)!.article.title, copy.article.title);
assert.equal(ledger.size, 1);
const summary=ledger.summary();
assert.equal(summary.height,1);assert.equal(summary.tip,candidate.hash);
const page=ledger.canonicalPage(summary.tip,0,1);
assert.equal(page.blocks.length,1);assert.equal(page.next,null);
page.blocks[0].article.title='mutated page';
assert.notEqual(ledger.canonicalPage(summary.tip,0).blocks[0].article.title,'mutated page');
assert.throws(()=>ledger.canonicalPage(GENESIS_HASH,0),/tip changed/);
assert.throws(()=>ledger.canonicalPage(summary.tip,0,17),/Invalid/);
assert.throws(()=>ledger.legacySnapshot(0),/Full snapshot disabled/);
assert.equal(ledger.legacySnapshot(1).blocks.length,1);
assert.throws(() => ledger.inventory(-1, 32));
assert.throws(() => ledger.inventory(0, 0));
});
test('timestamp attack boundaries reject at median and beyond future limit before proof work',async t=>{
const {ledger,engine}=await fixture(t);
const now=GENESIS_TIME+CONSENSUS.targetSeconds*20;
t.mock.method(Date,'now',()=>now*1000);
const candidate=await mine(ledger.template(alice.owner,alice.publicKey,articleFor([]),statsSnapshot()));
const calls=engine.calls;
await assert.rejects(ledger.submit({...candidate,createdAt:GENESIS_TIME}),/timestamp/);
await assert.rejects(ledger.submit({...candidate,createdAt:now+CONSENSUS.maxFutureSeconds+1}),/timestamp/);
assert.equal(engine.calls,calls);assert.equal(ledger.size,0);
// Full validation reaches commitment checks for the exact allowed future edge, not timestamp rejection.
await assert.rejects(ledger.submit({...candidate,createdAt:now+CONSENSUS.maxFutureSeconds}),/block ID/);
assert.equal(engine.calls,calls);
});
test('historical replay survives a local clock rollback after accepting the future-skew boundary',async t=>{
const dir=await mkdtemp(join(tmpdir(),'wikideck-clock-replay-'));
const admissionTime=GENESIS_TIME+CONSENSUS.targetSeconds*20;
const powEngine=new FakePow();
const ledger=await Ledger.open(dir,powEngine,()=>admissionTime);
const template=makeTemplate([],{},alice.owner,alice.publicKey,[],articleFor([]),statsSnapshot(),
admissionTime+CONSENSUS.maxFutureSeconds);
const block=await mine(template);
assert.equal(block.createdAt,admissionTime+CONSENSUS.maxFutureSeconds);
assert.deepEqual(await ledger.submit(block),{accepted:true,reorg:false});
const accepted=ledger.snapshot();ledger.close();
const restarted=await Ledger.open(dir,new FakePow(),()=>admissionTime-CONSENSUS.maxFutureSeconds-1);
t.after(async()=>{restarted.close();await rm(dir,{recursive:true,force:true});});
assert.deepEqual(restarted.snapshot(),accepted);
});
test('legacy JSON import cannot seed future-dated blocks, even after restart',async t=>{
const dir=await mkdtemp(join(tmpdir(),'wikideck-future-legacy-'));
const admissionTime=GENESIS_TIME+CONSENSUS.targetSeconds*20;
const networkDir=join(dir,'testnet');await mkdir(networkDir,{recursive:true});
const template=makeTemplate([],{},alice.owner,alice.publicKey,[],articleFor([]),statsSnapshot(),
admissionTime+CONSENSUS.maxFutureSeconds+1);
const futureBlock=await mine(template);
await writeFile(join(networkDir,'ledger.json'),JSON.stringify({version:1,network:NETWORK,chainId:CHAIN_ID,
blocks:[futureBlock],pendingTransfers:[]}));
for(let attempt=0;attempt<2;attempt++) {
await assert.rejects(Ledger.open(dir,new FakePow(),()=>admissionTime),/timestamp/);
}
t.after(async()=>{await rm(dir,{recursive:true,force:true});});
});
test('invalid claimed RandomX proof is rejected before full NFT-state enumeration',async()=>{
const template=makeTemplate([],{},alice.owner,alice.publicKey,[],articleFor([]),statsSnapshot());
const badHeader={...template.header,stateRoot:'f'.repeat(64)};
const blob=miningBlob(badHeader),hash=sha256(blob);
const candidate:TestnetBlock={...badHeader,hash,tokenId:mintId(badHeader),powHash:'0'.repeat(64),
signature:alice.sign(blockClaimMessage(hash)),transactions:[]};
let enumerations=0,hashCalls=0;
const parentState=new Proxy(Object.create(null) as NftState,{ownKeys(target){enumerations++;return Reflect.ownKeys(target);}});
const verifier:PowEngine={async hash(){hashCalls++;return 'f'.repeat(64);},close(){}};
await assert.rejects(validateBlock(candidate,[],parentState,verifier),/Invalid RandomX proof/);
assert.equal(hashCalls,1);
assert.equal(enumerations,0,'invalid work must be rejected before materializing the full NFT state');
});
test('DAG retains equal-work branches, serializes duplicates and selects strictly greater cumulative work', async t => {
const { ledger, dir } = await fixture(t);
t.mock.method(Date, 'now', () => (GENESIS_TIME + CONSENSUS.targetSeconds * 20) * 1000);
const slow = branch(), fast = branch();
for (let i = 0; i < 12; i++) await ledger.submit(await extend(slow, alice, [], CONSENSUS.targetSeconds));
for (let i = 0; i < 10; i++) {
const result = await ledger.submit(await extend(fast, bob, [], 1));
assert.equal(result.reorg, false);
assert.equal(ledger.snapshot().tip, slow.blocks.at(-1)!.hash);
}
const hard = await extend(fast, bob, [], 1);
assert.ok(workFor(hard.target) > workFor(slow.blocks.at(-1)!.target));
assert.equal(hard.height, 11); // A shorter, harder branch wins over height 12.
const results = await Promise.all([ledger.submit(hard), ledger.submit(hard), ledger.submit(hard)]);
assert.deepEqual(results, [{ accepted: true, reorg: true },
{ accepted: false, reorg: false }, { accepted: false, reorg: false }]);
assert.equal(ledger.snapshot().tip, hard.hash);
assert.deepEqual(ledger.snapshot().blocks, fast.blocks);
assert.equal(ledger.size, 23);
assert.equal(ledger.snapshot().cumulativeWork, fast.blocks.reduce((n, b) => n + workFor(b.target), 0n).toString());
const stored = ledger.allBlocks;
const seen = new Set([GENESIS_HASH]);
for (const b of stored) { assert.ok(seen.has(b.previousHash)); seen.add(b.hash); }
assert.deepEqual(ledger.inventory(10, 3), stored.slice(10, 13));
const restart = await Ledger.open(dir, new FakePow());
t.after(async () => { restart.close(); });
assert.deepEqual(restart.snapshot(), ledger.snapshot());
assert.deepEqual(restart.allBlocks, stored);
});
test('a deeper competing fork disconnects the old chain only after cumulative work wins',async t=>{
const {ledger}=await fixture(t);const original=branch(),competitor=branch();
t.mock.method(Date,'now',()=>(GENESIS_TIME+CONSENSUS.targetSeconds*100)*1000);
for(let i=0;i<30;i++)await ledger.submit(await extend(original,alice,[],CONSENSUS.targetSeconds));
assert.equal(ledger.snapshot().tip,original.blocks.at(-1)!.hash);
for(let i=0;i<15;i++){
const result=await ledger.submit(await extend(competitor,bob,[],1));
assert.equal(result.reorg,false);
assert.equal(ledger.snapshot().tip,original.blocks.at(-1)!.hash);
}
assert.equal(competitor.blocks.at(-1)!.height,15);
assert.notEqual(competitor.blocks.at(-1)!.target,MAX_TARGET);
const winning=await ledger.submit(await extend(competitor,bob,[],1));
assert.deepEqual(winning,{accepted:true,reorg:true});
assert.ok(ledger.snapshot().cumulativeWork===competitor.blocks.reduce((sum,block)=>sum+workFor(block.target),0n).toString());
assert.deepEqual(ledger.snapshot().blocks,competitor.blocks);
assert.equal(ledger.size,46,'both branches remain available in the DAG');
});
test('equal-work ties preserve the current tip across restart and only extension triggers reorg', async t => {
const { dir, ledger } = await fixture(t);
const a = branch(), b = branch();
const a1 = await extend(a), b1 = await extend(b, bob);
await ledger.submit(a1);
assert.deepEqual(await ledger.submit(b1), { accepted: true, reorg: false });
assert.equal(ledger.snapshot().tip, a1.hash);
const restart = await Ledger.open(dir, new FakePow());
t.after(async () => { restart.close(); });
assert.equal(restart.snapshot().tip, a1.hash);
const b2 = await extend(b, bob);
assert.deepEqual(await restart.submit(b2), { accepted: true, reorg: true });
assert.equal(restart.snapshot().tip, b2.hash);
});
test('NFT maturity, ordered mempool, block commitments and replay protection', async t => {
const { ledger, dir } = await fixture(t);
const chain = branch();
const minted = await extend(chain);
await ledger.submit(minted);
const tx = transfer(minted.tokenId);
await assert.rejects(ledger.submitTransfer(tx), /immature/);
await assert.rejects(async () => ledger.submit(await extend({ blocks: [...chain.blocks], state: structuredClone(chain.state) }, alice, [tx])), /immature/);
await ledger.submit(await extend(chain));
assert.equal(await ledger.submitTransfer(tx), transferId(tx));
const tx2 = transfer(minted.tokenId, bob, carol, 1);
await Promise.all([ledger.submitTransfer(tx2), ledger.submitTransfer(tx)]);
assert.deepEqual(ledger.snapshot().pendingTransfers, [tx, tx2]);
assert.equal(testnetOwnerOf(ledger.snapshot(), minted.tokenId), alice.owner); // Unconfirmed is not ownership.
const restarted = await Ledger.open(dir, new FakePow());
t.after(async () => { restarted.close(); });
assert.deepEqual(restarted.snapshot().pendingTransfers, [tx, tx2]);
const block = await mine(restarted.template(alice.owner, alice.publicKey,
articleFor(restarted.snapshot().blocks), statsSnapshot()));
assert.deepEqual(block.transactions, [tx, tx2]);
await restarted.submit(block);
assert.equal(testnetOwnerOf(restarted.snapshot(), minted.tokenId), carol.owner);
assert.deepEqual(restarted.snapshot().transfers, [tx, tx2]);
assert.deepEqual(restarted.snapshot().pendingTransfers, []);
await assert.rejects(restarted.submitTransfer(tx), /owner\/sequence/);
await assert.rejects(restarted.submitTransfer(transfer(minted.tokenId, carol, alice, 0)), /owner\/sequence/);
});
test('signed multi-card trade is validated, mempooled, mined, and applied atomically', async t => {
const { ledger } = await fixture(t);
const chain = branch();
const aliceFirst = await extend(chain, alice); await ledger.submit(aliceFirst);
const bobFirst = await extend(chain, bob); await ledger.submit(bobFirst);
const aliceSecond = await extend(chain, alice); await ledger.submit(aliceSecond);
const bobSecond = await extend(chain, bob); await ledger.submit(bobSecond);
await ledger.submit(await extend(chain, alice)); // All four NFTs are mature at the next inclusion height.
const offered = [aliceFirst, aliceSecond], requested = [bobFirst, bobSecond];
const invalid = trade(offered, requested);
const badTerms = { ...invalid, requested: invalid.requested.map((leg, index) =>
index === 1 ? { ...leg, sequence: 1 } : leg) };
const badMessage = nftTradeMessage(badTerms);
const badSequence = { ...badTerms, proposerSignature: alice.sign(badMessage), counterpartySignature: bob.sign(badMessage) };
const before = ledger.snapshot();
await assert.rejects(ledger.submitTransaction(badSequence), /missing, stale, or immature/);
const badSignature = { ...invalid, proposerSignature: bob.sign(nftTradeMessage(invalid)) };
await assert.rejects(ledger.submitTransaction(badSignature), /signature/i);
assert.deepEqual(ledger.snapshot().pendingTransfers, []);
for (const block of offered) assert.equal(testnetOwnerOf(before, block.tokenId), alice.owner);
for (const block of requested) assert.equal(testnetOwnerOf(before, block.tokenId), bob.owner);
const bundle = trade(offered, requested);
await ledger.submitTransaction(bundle);
assert.deepEqual(ledger.snapshot().pendingTransfers, [bundle]);
const template = ledger.template(alice.owner, alice.publicKey, articleFor(ledger.snapshot().blocks), statsSnapshot());
assert.deepEqual(template.transactions, [bundle]);
await ledger.submit(await mine(template));
const after = ledger.snapshot();
assert.equal(after.pendingTransfers.length, 0);
for (const block of offered) assert.equal(testnetOwnerOf(after, block.tokenId), bob.owner);
for (const block of requested) assert.equal(testnetOwnerOf(after, block.tokenId), alice.owner);
assert.deepEqual(after.transfers.at(-1), bundle);
for (const block of after.blocks) {
const indexed = ledger.nft(block.tokenId)!;
assert.equal(indexed.owner, testnetOwnerOf(after, block.tokenId));
assert.equal(indexed.sequence, after.transfers.filter(tx => transactionCardIds(tx).includes(block.tokenId)).length);
}
const deck = ledger.deck(alice.owner, 0, 2);
assert.equal(deck.total, after.blocks.filter(block => testnetOwnerOf(after, block.tokenId) === alice.owner).length);
assert.equal(deck.nfts.length, 2);
assert.equal(deck.next, 2);
assert.deepEqual(ledger.deck(alice.owner, deck.next!, 2).nfts.map(item => item.block.tokenId).sort(),
ledger.deck(alice.owner).nfts.slice(2).map(item => item.block.tokenId).sort());
assert.deepEqual(ledger.deck(alice.owner).nfts.map(item => item.block.tokenId).sort(),
after.blocks.filter(block => testnetOwnerOf(after, block.tokenId) === alice.owner)
.map(block => block.tokenId).sort());
});
test('reorg rolls back NFT ownership and requeues only still-valid disconnected transfers in order', async t => {
const { ledger, dir } = await fixture(t);
const original = branch();
const minted = await extend(original);
await ledger.submit(minted);
await ledger.submit(await extend(original));
const fork: Branch = structuredClone(original);
const tx = transfer(minted.tokenId);
const tx2 = transfer(minted.tokenId, bob, carol, 1);
const committed = await extend(original, alice, [tx, tx2]);
await ledger.submit(committed);
const orphanTx = transfer(committed.tokenId);
await ledger.submit(await extend(original));
await ledger.submitTransfer(orphanTx);
for (let i = 0; i < 3; i++) await ledger.submit(await extend(fork, bob));
const snapshot = ledger.snapshot();
assert.equal(snapshot.tip, fork.blocks.at(-1)!.hash);
assert.equal(testnetOwnerOf(snapshot, minted.tokenId), alice.owner);
assert.equal(testnetOwnerOf(snapshot, committed.tokenId), undefined);
assert.deepEqual(snapshot.transfers, []);
assert.deepEqual(snapshot.pendingTransfers, [tx, tx2]); // Orphan issuance is discarded.
assert.equal(ledger.nft(minted.tokenId)!.owner, alice.owner);
assert.equal(ledger.nft(minted.tokenId)!.sequence, 0);
assert.equal(ledger.nft(committed.tokenId), undefined);
assert.equal(ledger.canonicalTransaction(transferId(tx)), undefined);
assert.ok(ledger.block(committed.hash));
const restored = await Ledger.open(dir, new FakePow());
t.after(async () => { restored.close(); });
assert.deepEqual(restored.snapshot(), snapshot);
assert.equal(restored.canonicalHead(), ledger.canonicalHead());
assert.deepEqual(restored.canonicalEvents(0), ledger.canonicalEvents(0));
const next = await mine(ledger.template(bob.owner, bob.publicKey,
articleFor(ledger.snapshot().blocks), statsSnapshot()), bob);
await ledger.submit(next);
assert.equal(testnetOwnerOf(ledger.snapshot(), minted.tokenId), carol.owner);
assert.equal(ledger.nft(minted.tokenId)!.owner, carol.owner);
assert.equal(ledger.nft(minted.tokenId)!.sequence, 2);
});
test('canonical event pages record reorg order durably but exclude side branches, duplicates and mempool', async t => {
const { ledger, file, dir } = await fixture(t), original = branch();
const first = await extend(original); await ledger.submit(first);
const second = await extend(original); await ledger.submit(second);
const fork: Branch = structuredClone(original);
const tx = transfer(first.tokenId);
await ledger.submitTransfer(tx);
const beforePending = ledger.canonicalHead();
assert.equal(beforePending, 2);
const third = await extend(original, alice, [tx]); await ledger.submit(third);
assert.equal(ledger.canonicalTransaction(transferId(tx))?.blockHash, third.hash);
const competing = await extend(fork, bob); await ledger.submit(competing);
assert.equal(ledger.canonicalHead(), 3); // Equal-work branch does not change canonical state.
const winner = await extend(fork, bob); await ledger.submit(winner);
assert.equal(ledger.canonicalHead(), 6);
assert.equal(ledger.canonicalTransaction(transferId(tx)), undefined);
const events = ledger.canonicalEvents(0).events;
assert.deepEqual(events.map(e => [e.type, e.hash]), [
['connect', first.hash], ['connect', second.hash], ['connect', third.hash],
['disconnect', third.hash], ['connect', competing.hash], ['connect', winner.hash],
]);
assert.deepEqual(events[3].transactionIds, [transferId(tx)]);
const page = ledger.canonicalEvents(2, 1);
assert.equal(page.cursor, 3); assert.equal(page.caughtUp, false); assert.equal(page.head, 6);
page.events[0].transactionIds.length = 0;
assert.equal(ledger.canonicalEvents(2, 1).events[0].transactionIds.length, 1);
for (const [after, limit] of [[-1, 1], [7, 1], [0, 65], [0, 0], [0.5, 1]]) {
assert.throws(() => ledger.canonicalEvents(after, limit), /cursor/);
}
await ledger.submit(winner); assert.equal(ledger.canonicalHead(), 6);
ledger.close();
const reopened = await Ledger.open(dir, new FakePow());
try {
assert.equal(reopened.canonicalHead(), 6); assert.deepEqual(reopened.canonicalEvents(0).events, events);
const db = new DatabaseSync(file);
try { assert.throws(() => db.exec("UPDATE canonical_events SET type='connect'"), /Immutable/); } finally { db.close(); }
} finally { reopened.close(); }
});
test('block, mempool, canonical indexes and events roll back together on storage failure', async t => {
const { ledger, file } = await fixture(t), chain = branch();
const candidate = await extend(chain), db = new DatabaseSync(file);
try {
db.exec("CREATE TRIGGER fail_event BEFORE INSERT ON canonical_events BEGIN SELECT RAISE(ABORT,'injected storage failure'); END");
await assert.rejects(ledger.submit(candidate), /injected storage failure/);
assert.equal(ledger.size, 0); assert.equal(ledger.canonicalHead(), 0); assert.equal(ledger.nft(candidate.tokenId), undefined);
assert.equal((db.prepare('SELECT COUNT(*) AS n FROM blocks').get() as { n: number }).n, 0);
db.exec('DROP TRIGGER fail_event');
await ledger.submit(candidate);
assert.equal(ledger.nft(candidate.tokenId)!.owner, alice.owner); assert.equal(ledger.canonicalHead(), 1);
} finally { db.close(); }
});
test('validated existing ledgers backfill indexes once and refuse corrupt ownership or event history', async t => {
const { ledger, file, dir } = await fixture(t), chain = branch();
await ledger.submit(await extend(chain)); await ledger.submit(await extend(chain));
const expected = ledger.snapshot(); ledger.close();
const db = new DatabaseSync(file);
try {
// Simulate the prior schema: preserve original blocks/metadata/pending exactly, remove only new derived tables.
db.exec('DROP TABLE canonical_undo; DROP TABLE canonical_transactions; DROP TABLE canonical_nfts; DROP TABLE canonical_blocks; DROP TABLE canonical_events; DROP TABLE canonical_meta;');
} finally { db.close(); }
const migrated = await Ledger.open(dir, new FakePow());
assert.deepEqual(migrated.snapshot(), expected); assert.equal(migrated.canonicalHead(), 2); migrated.close();
const corrupt = new DatabaseSync(file);
try { corrupt.prepare('UPDATE canonical_nfts SET owner=? WHERE token=?').run(bob.owner, chain.blocks[0].tokenId); }
finally { corrupt.close(); }
await assert.rejects(Ledger.open(dir, new FakePow()), /ownership index mismatch/);
const repair = new DatabaseSync(file);
try {
repair.prepare('UPDATE canonical_nfts SET owner=? WHERE token=?').run(alice.owner, chain.blocks[0].tokenId);
repair.exec('DROP TRIGGER canonical_events_no_update');
repair.exec("UPDATE canonical_events SET transactions_json='[\"wrong\"]' WHERE sequence=1");
} finally { repair.close(); }
await assert.rejects(Ledger.open(dir, new FakePow()), /event integrity mismatch/);
});
test('reorg removes mempool conflicts and does not requeue already committed transfers', async t => {
const { ledger } = await fixture(t);
const a = branch();
const minted = await extend(a);
await ledger.submit(minted);
await ledger.submit(await extend(a));
const b: Branch = structuredClone(a);
const tx = transfer(minted.tokenId);
await ledger.submit(await extend(a, alice, [tx]));
await ledger.submitTransfer(transfer(minted.tokenId, bob, alice, 1));
await ledger.submit(await extend(b, bob, [tx, transfer(minted.tokenId, bob, carol, 1)]));
await ledger.submit(await extend(b, bob));
assert.deepEqual(ledger.snapshot().pendingTransfers, []);
assert.equal(testnetOwnerOf(ledger.snapshot(), minted.tokenId), carol.owner);
});
test('invalid parent, manifest, proof, article/stat snapshots, and commitments leave ledger unchanged', async t => {
const { ledger } = await fixture(t);
const valid = await extend(branch());
assert.notEqual(mintId(valid), mintId({ ...valid,
statsSnapshot: { ...valid.statsSnapshot, capturedAt: '2026-10-19T00:00:01.000Z' } }));
for (const changed of [ { previousHash: 'aa'.repeat(32) }, { chainId: 'bb'.repeat(32) },
{ network: 'another-network' }, { article: { ...valid.article, extract: 'tampered snapshot' } },
{ article: { ...valid.article, image: 'https://evil.example/image.jpg' } },
{ article: { ...valid.article, image: undefined } },
{ statsSnapshot: { ...valid.statsSnapshot, capturedAt: '2026-10-19T00:00:01.000Z' } },
{ statsSnapshot: { ...valid.statsSnapshot, stats: { ...valid.statsSnapshot.stats, depth: 0 } } },
{ stateRoot: '00'.repeat(32) }, { transactionsRoot: '00'.repeat(32) },
{ tokenId: '00'.repeat(32) }, { powHash: '00'.repeat(32) }, { nonce: valid.nonce + 1 },
{ signature: bob.sign(blockClaimMessage(valid.hash)) } ]) {
await assert.rejects(ledger.submit({ ...valid, ...changed }));
assert.equal(ledger.size, 0);
}
await assert.rejects(ledger.submitTransfer({ ...transfer('aa'.repeat(32)), chainId: 'bb'.repeat(32) }));
await ledger.submit(valid); // Queue recovers from failed validations.
const repeated = await mine(ledger.template(alice.owner, alice.publicKey, valid.article, valid.statsSnapshot));
assert.equal(repeated.article.pageId, valid.article.pageId);
assert.notEqual(repeated.tokenId, valid.tokenId);
await ledger.submit(repeated);
assert.equal(ledger.size, 2);
});
test('block state is stored as a one-entry delta that shares its parent state layer', async () => {
const parent: NftState = Object.assign(Object.create(null) as NftState, {
['a'.repeat(64)]: { owner: alice.owner, sequence: 0, mintedHeight: 1, pageId: 50_000 },
});
const chain: Branch = { blocks: [], state: parent };
await extend(chain);
const layer = chain.state as NftStateLayer;
assert.equal(layer.kind, 'layer');
assert.equal(layer.parent, parent);
assert.equal(Object.keys(layer.changes).length, 1);
});
test('SQLite startup rechecks every proof and fails closed on database corruption or manifest mismatch', async t => {
const { dir, ledger, file } = await fixture(t);
const chain = branch();
await ledger.submit(await extend(chain));
await ledger.submit(await extend(chain));
const checking = new FakePow();
const verified = await Ledger.open(dir, checking);
t.after(async () => { verified.close(); });
assert.equal(checking.calls, 2);
const originalDb = new DatabaseSync(file);
const row = originalDb.prepare('SELECT hash, block_json FROM blocks ORDER BY sequence LIMIT 1').get() as { hash: string; block_json: string };
const originalBlock = JSON.parse(row.block_json) as TestnetBlock;
originalDb.close();
verified.close();
ledger.close();
const malformed = new DatabaseSync(file);
malformed.prepare('UPDATE blocks SET block_json = ? WHERE hash = ?').run('{truncated', row.hash);
malformed.close();
await assert.rejects(Ledger.open(dir, new FakePow()));
const restoreMalformed = new DatabaseSync(file);
restoreMalformed.prepare('UPDATE blocks SET block_json = ? WHERE hash = ?').run(row.block_json, row.hash);
restoreMalformed.close();
const tampered = new DatabaseSync(file);
tampered.prepare('UPDATE blocks SET block_json = ? WHERE hash = ?')
.run(JSON.stringify({ ...originalBlock, stateRoot: '00'.repeat(32) }), row.hash);
tampered.close();
await assert.rejects(Ledger.open(dir, new FakePow()), /block ID/);
const restoreTampered = new DatabaseSync(file);
restoreTampered.prepare('UPDATE blocks SET block_json = ? WHERE hash = ?').run(row.block_json, row.hash);
restoreTampered.prepare("UPDATE metadata SET value = 'wrong' WHERE key = 'network'").run();
restoreTampered.close();
await assert.rejects(Ledger.open(dir, new FakePow()), /mismatch/);
const restoreManifest = new DatabaseSync(file);
restoreManifest.prepare('UPDATE metadata SET value = ? WHERE key = ?').run(NETWORK, 'network');
restoreManifest.close();
await assert.rejects(Ledger.open(dir, { hash: async () => 'ff'.repeat(32), close() {} }), /RandomX proof/);
});
test('failed SQLite transaction never commits memory, and later mutations recover', async t => {
const { ledger, file } = await fixture(t);
const database = new DatabaseSync(file);
database.exec("CREATE TRIGGER reject_block BEFORE INSERT ON blocks BEGIN SELECT RAISE(ABORT, 'test persistence failure'); END;");
database.close();
const valid = await extend(branch());
await assert.rejects(ledger.submit(valid));
assert.equal(ledger.size, 0);
assert.equal(ledger.snapshot().tip, GENESIS_HASH);
const removeTrigger = new DatabaseSync(file);
removeTrigger.exec('DROP TRIGGER reject_block');
removeTrigger.close();
await ledger.submit(valid);
assert.equal(ledger.size, 1);
});
test('legacy JSON ledger imports once into SQLite without altering its source file', async t => {
const dir = await mkdtemp(join(tmpdir(), 'wikideck-legacy-ledger-'));
const block = await extend(branch());
const original = { version: 1, network: NETWORK, chainId: CHAIN_ID, blocks: [block], pendingTransfers: [] };
const legacyFile = join(dir, 'testnet', 'ledger.json');
await mkdir(join(dir, 'testnet'), { recursive: true });
await writeFile(legacyFile, JSON.stringify(original));
const ledger = await Ledger.open(dir, new FakePow());
t.after(async () => { ledger.close(); await rm(dir, { recursive: true, force: true }); });
assert.deepEqual(ledger.snapshot().blocks, [block]);
assert.deepEqual(JSON.parse(await readFile(legacyFile, 'utf8')), original);
const database = new DatabaseSync(join(dir, 'testnet', 'ledger.sqlite'));
assert.equal((database.prepare("SELECT value FROM metadata WHERE key = 'legacy_json_migrated'").get() as { value: string }).value, '1');
database.close();
});
test('mempool is ordered, capped at 256, and templates include at most 64 without new issuance', async t => {
const { ledger, dir } = await fixture(t);
const chain = branch();
const minted = await extend(chain);
await ledger.submit(minted);
await ledger.submit(await extend(chain));
const transactions = Array.from({ length: 256 }, (_, sequence) => transfer(minted.tokenId,
sequence % 2 === 0 ? alice : bob, sequence % 2 === 0 ? bob : alice, sequence));
await Promise.all(transactions.map(tx => ledger.submitTransfer(tx)));
assert.deepEqual(ledger.snapshot().pendingTransfers, transactions);
await assert.rejects(ledger.submitTransfer(transfer(minted.tokenId, alice, bob, 256)), /256/);
const template = ledger.template(alice.owner, alice.publicKey,
articleFor(ledger.snapshot().blocks), statsSnapshot());
assert.deepEqual(template.transactions, transactions.slice(0, 64));
await assert.rejects(ledger.submitTransfer(transfer(mintId(template.header))), /256/);
const block = await mine(template);
await ledger.submit(block);
assert.deepEqual(ledger.snapshot().pendingTransfers, transactions.slice(64));
await assert.rejects(ledger.submitTransfer(transfer(block.tokenId)), /immature/);
const restarted = await Ledger.open(dir, new FakePow());
t.after(async () => { restarted.close(); });
assert.deepEqual(restarted.snapshot(), ledger.snapshot());
});
async function server(t: { after: (fn: () => Promise<void>) => void },
handler: (req: IncomingMessage, res: ServerResponse) => void) {
const instance = createServer(handler);
await new Promise<void>(resolve => instance.listen(0, '127.0.0.1', resolve));
t.after(() => new Promise<void>((resolve, reject) => {
instance.close(error => error ? reject(error) : resolve()); instance.closeAllConnections();
}));
const addr = instance.address();
assert.ok(addr && typeof addr !== 'string');
return `http://127.0.0.1:${addr.port}`;
}
function json(res: ServerResponse, body: unknown) { res.setHeader('content-type', 'application/json'); res.end(JSON.stringify(body)); }
async function until(check: () => boolean) {
const deadline = Date.now() + 5000;
while (!check()) { if (Date.now() > deadline) assert.fail('Peer operation timed out'); await delay(10); }
}
test('peer configuration rejects unsafe origins; explicit private permission enables local sync', async t => {
const { ledger } = await fixture(t);
for (const url of ['http://example.com', 'https://localhost', 'https://foo.localhost',
'https://127.1', 'https://10.1.2.3', 'https://169.254.169.254', 'https://[::1]',
'https://[::ffff:127.0.0.1]', 'https://[fc00::1]', 'https://[fe80::1]',
'https://[2002:7f00:1::]', 'https://example.com/path', 'https://user:pass@example.com',
'https://example.com/?q=1', 'https://example.com/#fragment', 'https://example.com/?',
'https://example.com/#', 'https://example.com/path/..', 'https://@example.com', 'ftp://example.com']) {
assert.throws(() => new PeerNetwork({ ledger, urls: [url], allowPrivate: false }), url);
}
const chain = branch();
const b = await extend(chain);
const paths: string[] = [];
const url = await server(t, (req, res) => {
paths.push(req.url!);
if (req.url === '/p2p/status') json(res, { network: NETWORK, chainId: CHAIN_ID, size: 1 });
else if (req.url === '/p2p/blocks?offset=0') json(res, { blocks: [b], next: null });
else if (req.url === '/p2p/mempool') json(res, { transactions: [] });
else json(res, { accepted: true });
});
const network = new PeerNetwork({ ledger, urls: [url], allowPrivate: true });
t.after(async () => network.close());
network.start(); network.start();
await until(() => network.status()[0].connected);
assert.equal(ledger.size, 1);
assert.equal(ledger.snapshot().peers, 1);
await network.broadcastBlock(b);
assert.ok(paths.includes('/p2p/block'));
await assert.rejects(network.broadcastTransfer(transfer(b.tokenId)), /unaccepted/);
network.close();
assert.equal(ledger.snapshot().peers, 0);
});
test('unknown SQLite files are rejected without adding or replacing tables', async t => {
const dir = await mkdtemp(join(tmpdir(), 'wikideck-foreign-sqlite-'));
const file = join(dir, 'testnet', 'ledger.sqlite');
await mkdir(join(dir, 'testnet'), { recursive: true });
const foreign = new DatabaseSync(file);
foreign.exec('CREATE TABLE operator_data(value TEXT NOT NULL); INSERT INTO operator_data VALUES(\'keep\');');
foreign.close();
t.after(async () => { await rm(dir, { recursive: true, force: true }); });
await assert.rejects(Ledger.open(dir, new FakePow()), /metadata missing/);
const verify = new DatabaseSync(file);
assert.deepEqual((verify.prepare("SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name").all() as { name: string }[])
.map(row => row.name), ['operator_data']);
assert.equal((verify.prepare('SELECT value FROM operator_data').get() as { value: string }).value, 'keep');
verify.close();
});
test('peers verify DNS, manifests, pagination, payloads and consensus; redirects are not followed', async t => {
const { ledger } = await fixture(t);
const chain = branch();
const b = await extend(chain);
let redirected = false;
for (const mode of ['manifest', 'pagination', 'proof', 'oversized', 'redirect'] as const) {
const url = await server(t, (req, res) => {
if (req.url === '/redirect-target') { redirected = true; json(res, {}); return; }
if (mode === 'redirect') { res.writeHead(302, { location: '/redirect-target' }); res.end(); return; }
if (mode === 'oversized') { res.setHeader('content-type', 'application/json'); res.end(' '.repeat(2 * 1024 * 1024 + 1)); return; }
if (req.url === '/p2p/status') json(res, { network: NETWORK, chainId: mode === 'manifest' ? 'bad' : CHAIN_ID, size: 1 });
else json(res, mode === 'pagination' ? { blocks: [b], next: 0 } : { blocks: [{ ...b, powHash: '00'.repeat(32) }], next: null });
});
const network = new PeerNetwork({ ledger, urls: [url], allowPrivate: true });
network.start();
await until(() => Boolean(network.status()[0].error));
assert.equal(network.status()[0].connected, false);
assert.equal(ledger.size, 0);
network.close();
}
assert.equal(redirected, false);
// Deterministic DNS rebinding defense test: no external resolver/network dependency.
const lookupMock = t.mock.method(dns, 'lookup', async () => [
{ address: '93.184.216.34', family: 4 }, { address: '127.0.0.1', family: 4 },
]);
const dnsNetwork = new PeerNetwork({ ledger, urls: ['https://peer.example'], allowPrivate: false });
t.after(async () => dnsNetwork.close());
dnsNetwork.start();
await until(() => Boolean(dnsNetwork.status()[0].error));
assert.equal(dnsNetwork.status()[0].connected, false);
assert.match(dnsNetwork.status()[0].error!, /non-public/);
lookupMock.mock.restore();
});
test('peer sync pages at most 32 blocks per pass, preserves cursor and skips known blocks', async t => {
const { ledger, engine } = await fixture(t);
const chain = branch();
for (let i = 0; i < 33; i++) await extend(chain, alice, [], 30);
await ledger.submit(chain.blocks[0]);
const offsets: number[] = [];
const url = await server(t, (req, res) => {
if (req.url === '/p2p/status') json(res, { network: NETWORK, chainId: CHAIN_ID, size: chain.blocks.length });
else if (req.url === '/p2p/mempool') json(res, { transactions: [] });
else {
const offset = Number(new URL(req.url!, 'http://localhost').searchParams.get('offset'));
offsets.push(offset);
const blocks = chain.blocks.slice(offset, offset + 32);
json(res, { blocks, next: offset + blocks.length < chain.blocks.length ? offset + blocks.length : null });
}
});
const network = new PeerNetwork({ ledger, urls: [url], allowPrivate: true, intervalMs: 1000 });
t.after(async () => network.close());
network.start();
await until(() => network.status()[0].connected);
assert.equal(ledger.size, 32);
assert.deepEqual(offsets, [0]);
await until(() => ledger.size === 33);
assert.deepEqual(offsets, [0, 32]);
assert.equal(engine.calls, 33); // The already-known first block was not revalidated.
assert.deepEqual(ledger.snapshot().blocks, chain.blocks);
assert.equal(CONSENSUS.maxTransactions, 64);
});